Skip to content

Fragmentation & IDS evasion

1. Context & stakes

Overlapping fragments to defeat IDS reassembly.

IP fragmentation lets a packet be split and reassembled, but endpoints and IDS can disagree on how to reassemble overlapping fragments. An attacker crafts overlaps so the IDS sees benign data while the target reassembles the attack, slipping past inspection. This is a core Ptacek-Newsham evasion, and RFC-consistent reassembly enforced by the IDS is the fix.

2. Theory

IP fragments are reassembled by the destination via offset/ID/MF fields. An IDS must reassemble too; if it does so differently from the host (overlapping fragments, divergent timeouts/TTL) the attacker shows the IDS one stream and the host another - the classic Ptacek-Newsham insertion/evasion.

3. Attack (PoC)

netlab-frag attack --i-own-this-network --iface veth-host
  1. Overlapping fragments
  2. Divergent order/TTL host vs IDS

4. Detection

netlab-frag detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • Full reassembly on the IDS
  • Drop overlaps

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading